Kubernetes service account token created in container
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.What happened
A kubectl command was used to create a new service account token, potentially to establish persistence or escalate privileges.
Goal
Detect the use of kubectl commands inside a container to create a new service account token.
Strategy
This detection triggers when kubectl is executed with specific arguments related to creating a new service account token.
Triage and response
- Identify the purpose and scope of the service account.
- Confirm if the service account token being created is authorized.
- Determine the resources involved, such as new containers.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
Requires Agent version 7.27 or greater
